Stop compiling the GPL crate GPUI drags in behind the framework

Lumbridge is Apache-2.0, and decision 0023 quietly made it link
GPL-3.0-or-later. `crates/gpui/Cargo.toml` at the pinned revision carries
`ztracing.workspace = true` -- unconditional, not optional, not behind a
feature -- and `ztracing` is GPL-3.0-or-later, as are the `zlog` and
`ztracing_macro` it pulls. `sum_tree` asks for it too. The path is the ordinary
Linux build, not an `--all-features` artefact and not a dev-dependency:

    lumbridge -> gpui_platform -> gpui_linux -> gpui -> ztracing -> zlog
                                                                -> ztracing_macro

`cargo deny check licenses` failed on it, exit 4.

This is the second thing decision 0023 got wrong by reading the manifests of the
crates it added instead of resolving the graph; the first was believing there
were two Zed Git sources when there are five. Both were found by a gate that had
never been run.

There was no feature to turn off, so the choice was to relax the licence policy,
drop the framework, or stop compiling the crate. `ztracing` is now redirected by
a `[patch]` table at `crates/lumbridge-ztracing-shim`, a first-party
zero-dependency no-op under Apache-2.0. `zlog` and `ztracing_macro` were
reachable only through it and leave the lockfile with it.

The shim is small because the usage is: nine `#[instrument(skip_all)]` sites
across `gpui/src/svg_renderer.rs`, `sum_tree/src/sum_tree.rs` and
`sum_tree/src/cursor.rs`, and nothing else. Upstream's own crate compiles to
almost exactly this whenever the `ztracing` cfg is off, which is every build
that is not a Tracy profiling build, so no shipping behaviour is lost. It is a
proc-macro crate deliberately: such a crate can export nothing but proc macros,
so an upstream revision that starts using `ztracing::Span` or
`ztracing::info_span!` fails to compile and names the shim, rather than
resolving to something plausible.

`scripts/workspace-guard.sh` gained a third gate asserting, against Cargo.lock
rather than the manifest, that no `ztracing`, `zlog` or `ztracing_macro`
resolves to a Zed source and that the patch table is still present. `cargo deny`
already checks this, and the duplication is the point: `scripts/ci.sh`
downgrades a missing cargo-deny to a warning unless `LUMBRIDGE_CI_STRICT=1`, and
that is how the licence closure went ungated once already. A `[patch]` is an
unusually quiet thing to lose -- delete the table and everything still compiles,
still passes, and is GPL again.

Removing the three GPL rejections exposed a fourth that had been sitting beside
them and was never reported separately: `libbz2-rs-sys` under `bzip2-1.0.6`,
reached through async-compression <- http_client <- gpui. It is BSD-style and
permissive with no copyleft, and is allowed in `deny.toml` with that reasoning
written down. `cargo deny check licenses sources` is exit 0 for the first time.

The Git-source allowances in `deny.toml` are all still needed; the patched
crate's own source was `zed.git`, which `gpui` still requires.

Decision 0025 records the whole of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq

deny.toml

@@ -34,6 +34,15 @@ allow = [
     # attribution requirement on downstream distribution. It arrives through
     # ureq, which the Claude usage endpoint needs (decision 0016).
     "CDLA-Permissive-2.0",
+    # bzip2-1.0.6 is the bzip2/libbzip2 licence carried by libbz2-rs-sys. It is a
+    # BSD-style permissive licence -- retain the notice, do not misrepresent the
+    # origin, no warranty -- with no copyleft and no source-disclosure term. It
+    # reaches the graph as libbz2-rs-sys -> bzip2 -> compression-codecs ->
+    # async-compression -> http_client -> gpui, so it is in the ordinary Linux
+    # build and not an `--all-features` artefact. It was already failing this
+    # gate alongside the GPL crates; removing those made it the only rejection
+    # left, which is the first time anyone could see it.
+    "bzip2-1.0.6",
     # NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
     # graph only as rav1e -> ravif -> image -> gpui and only under
     # `all-features`; no shipped build links it. Allowed rather than excluded so
@@ -73,7 +82,22 @@ allow-git = [
     # backends now live in crates Zed does not publish at all.
     "https://github.com/zed-industries/zed",
     # Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
-    # source of Zed's own, so adopting the framework brings two Git sources
-    # rather than one. Naming it here is what stops that arriving unnoticed.
+    # source of Zed's own. Decision 0023 predicted that this made two Git
+    # sources rather than one. It was wrong, and the three below are why -- the
+    # resolved graph carries five Zed sources, not two. Each is reached through
+    # gpui_platform, which is to say through the Linux backend the move was made
+    # to obtain, and each is listed rather than waved through with a wildcard.
     "https://github.com/zed-industries/font-kit",
+    # X11 input methods, supplying zed-xim/xim-ctext/xim-parser to gpui_linux.
+    # This is the IME path, so it is load-bearing for a hard gate rather than
+    # incidental.
+    "https://github.com/zed-industries/xim-rs",
+    # Reached twice: through gpui_web, and through scheduler <- gpui.
+    "https://github.com/zed-industries/wasm_thread",
+    # Resolved in Cargo.lock but NOT reachable in this target's graph, so
+    # cargo deny does not currently object to it. Named anyway: it is screen
+    # capture, it arrives on another platform's build, and discovering it for
+    # the first time in a macOS CI failure would teach us nothing we cannot
+    # write down now.
+    "https://github.com/zed-industries/scap",
 ]